From owner-svn-src-stable-6@FreeBSD.ORG Thu May 27 03:15:06 2010 Return-Path: Delivered-To: svn-src-stable-6@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2001:4f8:fff6::34]) by hub.freebsd.org (Postfix) with ESMTP id 0B4CA106566B; Thu, 27 May 2010 03:15:06 +0000 (UTC) (envelope-from cperciva@FreeBSD.org) Received: from svn.freebsd.org (unknown [IPv6:2001:4f8:fff6::2c]) by mx1.freebsd.org (Postfix) with ESMTP id D1A508FC29; Thu, 27 May 2010 03:15:05 +0000 (UTC) Received: from svn.freebsd.org (localhost [127.0.0.1]) by svn.freebsd.org (8.14.3/8.14.3) with ESMTP id o4R3F5sm041617; Thu, 27 May 2010 03:15:05 GMT (envelope-from cperciva@svn.freebsd.org) Received: (from cperciva@localhost) by svn.freebsd.org (8.14.3/8.14.3/Submit) id o4R3F5Kl041615; Thu, 27 May 2010 03:15:05 GMT (envelope-from cperciva@svn.freebsd.org) Message-Id: <201005270315.o4R3F5Kl041615@svn.freebsd.org> From: Colin Percival Date: Thu, 27 May 2010 03:15:05 +0000 (UTC) To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-6@freebsd.org X-SVN-Group: stable-6 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Cc: Subject: svn commit: r208586 - head/contrib/opie/libopie head/lib/libc/sys head/sys/nfsclient head/usr.sbin/jail releng/6.4 releng/6.4/contrib/opie/libopie releng/6.4/sys/conf releng/7.1 releng/7.1/contrib/... X-BeenThere: svn-src-stable-6@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: SVN commit messages for only the 6-stable src tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Thu, 27 May 2010 03:15:06 -0000 Author: cperciva Date: Thu May 27 03:15:04 2010 New Revision: 208586 URL: http://svn.freebsd.org/changeset/base/208586 Log: Change the current working directory to be inside the jail created by the jail(8) command. [10:04] Fix a one-NUL-byte buffer overflow in libopie. [10:05] Correctly sanity-check a buffer length in nfs mount. [10:06] Approved by: so (cperciva) Approved by: re (kensmith) Security: FreeBSD-SA-10:04.jail Security: FreeBSD-SA-10:05.opie Security: FreeBSD-SA-10:06.nfsclient Modified: stable/6/contrib/opie/libopie/readrec.c Changes in other areas also in this revision: Modified: head/contrib/opie/libopie/readrec.c head/lib/libc/sys/mount.2 head/sys/nfsclient/nfs_vfsops.c head/usr.sbin/jail/jail.c releng/6.4/UPDATING releng/6.4/contrib/opie/libopie/readrec.c releng/6.4/sys/conf/newvers.sh releng/7.1/UPDATING releng/7.1/contrib/opie/libopie/readrec.c releng/7.1/sys/conf/newvers.sh releng/7.2/UPDATING releng/7.2/contrib/opie/libopie/readrec.c releng/7.2/lib/libc/sys/mount.2 releng/7.2/sys/conf/newvers.sh releng/7.2/sys/nfsclient/nfs_vfsops.c releng/7.3/UPDATING releng/7.3/contrib/opie/libopie/readrec.c releng/7.3/lib/libc/sys/mount.2 releng/7.3/sys/conf/newvers.sh releng/7.3/sys/nfsclient/nfs_vfsops.c releng/8.0/UPDATING releng/8.0/contrib/opie/libopie/readrec.c releng/8.0/lib/libc/sys/mount.2 releng/8.0/sys/conf/newvers.sh releng/8.0/sys/nfsclient/nfs_vfsops.c releng/8.0/usr.sbin/jail/jail.c stable/7/contrib/opie/libopie/readrec.c stable/7/lib/libc/sys/mount.2 stable/7/sys/nfsclient/nfs_vfsops.c stable/8/contrib/opie/libopie/readrec.c stable/8/lib/libc/sys/mount.2 stable/8/sys/nfsclient/nfs_vfsops.c stable/8/usr.sbin/jail/jail.c Modified: stable/6/contrib/opie/libopie/readrec.c ============================================================================== --- stable/6/contrib/opie/libopie/readrec.c Thu May 27 01:27:25 2010 (r208585) +++ stable/6/contrib/opie/libopie/readrec.c Thu May 27 03:15:04 2010 (r208586) @@ -139,10 +139,8 @@ int __opiereadrec FUNCTION((opie), struc if (c = strchr(opie->opie_principal, ':')) *c = 0; - if (strlen(opie->opie_principal) > OPIE_PRINCIPAL_MAX) - (opie->opie_principal)[OPIE_PRINCIPAL_MAX] = 0; - strcpy(principal, opie->opie_principal); + strlcpy(principal, opie->opie_principal, sizeof(principal)); do { if ((opie->opie_recstart = ftell(f)) < 0)